Tangerine Turkey Script From Removable Drive

Tim Peck@timpeck

•updated Oct 29, 2025•2•0•82

Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.